Loading…
Check password strength and security with detailed analysis and improvement recommendations.
This password strength checker estimates how resistant a password is to guessing and brute-force attacks. As you type, it produces a score out of 100, a plain-language rating, and specific feedback on how to improve. The score rewards length and a mix of character types — lowercase, uppercase, numbers, and symbols — while penalizing predictable patterns such as repeated characters and common sequences.
Alongside the score, the tool reports an entropy estimate: the character-pool size, the length, and the resulting bits of entropy, calculated as length multiplied by the base-2 logarithm of the pool size. It also shows an illustrative offline crack-time based on an optimistic guessing rate. These figures are a rough measure of unpredictability, not a guarantee — a password made of dictionary words can score higher than it deserves because entropy math cannot see that the words are common.
Everything runs entirely in your browser. The password you type is analyzed locally with JavaScript and is never uploaded, logged, or stored, so you can safely test real passwords. Use it to sanity-check a password before you rely on it, but for genuinely strong credentials, generate a long random password and store it in a password manager rather than inventing one by hand.
Yes. The analysis runs entirely in your browser using JavaScript, so the password you enter is never uploaded, logged, or stored anywhere.
Entropy measures how unpredictable a password is, in bits. It is estimated as length times the base-2 logarithm of the character-pool size — more length and a larger mix of character types mean higher entropy and a harder password to brute-force.
The checker penalizes predictable patterns such as repeated characters and common sequences. Adding length and a wider mix of character types usually raises the score more than swapping a single symbol.
It is illustrative only. It assumes a fixed, optimistic offline guessing rate and cannot account for dictionary attacks or password reuse, so treat it as a rough comparison rather than a precise prediction.
Use at least 16 characters, combine lowercase, uppercase, numbers, and symbols, and avoid dictionary words and reuse. The most reliable approach is to generate a random password and store it in a password manager.